diff --git a/backend/main.go b/backend/main.go
index 0df2814..2e21b4b 100644
--- a/backend/main.go
+++ b/backend/main.go
@@ -103,9 +103,21 @@ func main() {
 		c.Set("Cache-Control", "no-store, no-cache, must-revalidate")
 		return c.Next()
 	})
-	app.Use(helmet.New())
+	app.Use(helmet.New(helmet.Config{
+		// Relax cross-origin policies to allow OnlyOffice Document Server
+		// iframe embedding from a different origin (e.g. office.elijahkuntz.com)
+		CrossOriginEmbedderPolicy: "unsafe-none",
+		CrossOriginResourcePolicy: "cross-origin",
+	}))
+
+	// Build CSP with dynamic frame-src for the OnlyOffice Document Server
+	onlyOfficeFrameSrc := "https://" + cfg.OnlyOfficeHost
+	cspHeader := fmt.Sprintf(
+		"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self' wss: https: http:; frame-src 'self' %s;",
+		onlyOfficeFrameSrc,
+	)
 	app.Use(func(c *fiber.Ctx) error {
-		c.Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self' wss: https: http:;")
+		c.Set("Content-Security-Policy", cspHeader)
 		return c.Next()
 	})
 	allowedOrigins := os.Getenv("ALLOWED_ORIGINS")